What’s Vulnerable › Products
jqlang jq vulnerabilities
24 known vulnerabilities, 0 confirmed exploited in the wild (CISA KEV), 21 published in the last 12 months.
Check whether your jqlang jq version is affected
Latest jqlang jq vulnerabilities
- CVE-2026-54679 — jq: potential integer overflow in jvp_string_append (CVSS 5.5)
- CVE-2026-49839 — jq --rawfile invalid-state reuse after String too long causes heap-buffer-overflow (CVSS 7.1)
- CVE-2026-47770 — jq: stack overflow in deep structural equality (CVSS 5.5)
- CVE-2026-44777 — jq: stack overflow in module loading on mutual `include` (CVSS 5.5)
- CVE-2026-43896 — jq: Stack Overflow in Recursive Object Merge (CVSS 5.5)
- CVE-2026-43895 — jq: Embedded NUL in jq import paths causes local redaction-policy bypass and preserves sensitive fields in published artifacts (CVSS 4.4)
- CVE-2026-43894 — jq: Wild stack write via signed-integer overflow in decNumber D2U() macro (CVSS 5.5)
- CVE-2026-41257 — jq: Signed-int overflow in `stack_reallocate` (jq VM stack) (CVSS 5.5)
- CVE-2026-41256 — jq: Embedded NUL truncates top-level jq programs loaded with -f (CVSS 5.5)
- CVE-2026-40612 — jq: Stack overflow via unbounded recursion in jv_contains (CVSS 5.5)
- CVE-2026-40164 — jq: Algorithmic complexity DoS via hardcoded MurmurHash3 seed (CVSS 7.5)
- CVE-2026-33948 — jq: Embedded-NUL Truncation in CLI JSON Input Path Causes Prefix-Only Validation of Malformed Input (CVSS 5.3)
- CVE-2026-39979 — jq: Out-of-Bounds Read in jv_parse_sized() Error Formatting for Non-NUL-Terminated Counted Buffers (CVSS 6.5)
- CVE-2026-39956 — jq: Missing runtime type checks for _strindices lead to crash and limited memory disclosure (CVSS 6.1)
- CVE-2026-33947 — jq: Unbounded Recursion in jv_setpath(), jv_getpath() and delpaths_sorted() (CVSS 5.5)
- CVE-2026-32316 — jq: Integer overflow in jvp_string_append() allows Heap-based Buffer Overflow (CVSS 7.5)
- CVE-2025-9403 — jqlang jq JSON jq_test.c run_jq_tests assertion (CVSS 5.5)
- CVE-2025-49014 — jq heap use after free vulnerability in f_strflocaltime (CVSS 5.5)
- CVE-2025-48060 — AddressSanitizer: stack-buffer-overflow in jq_fuzz_execute (jv_string_vfmt) (CVSS 7.5)
- CVE-2024-23337 — jq has signed integer overflow in jv.c:jvp_array_write (CVSS 6.5)
- CVE-2024-53427 — (CVSS 8.1)
- CVE-2023-50268 — jq has stack-based buffer overflow in decNaNs (CVSS 5.5)
- CVE-2023-50246 — jq has heap-buffer-overflow vulnerability in the function decToString in decNumber.c (CVSS 5.5)
- CVE-2023-49355 — (CVSS 7.5)